Massive revelation (and shit UX) of the day:
Google actually still allows using hardware keys as
#Passkeys on Linux, but I couldn't figure this out for *months*!
When you go to your account settings and try to add an MFA device the page shows that you can't create a Passkey on this device. When you click "Create Passkey" you are once again reminded that you can't create it on this device.
But now (on the error dialog) when you click "Use another device" the Passkey is created on your FIDO token - because it *is* another device!
I've been in the IT-security biz for ~20 years. I can't imagine how a normal person would figure this out.